[63313] in North American Network Operators' Group

home	help	back	first	fref	pref	prev	next	nref	lref	last	post

DNS scans by IANA

daemon@ATHENA.MIT.EDU (Andrew Fried)
Fri Oct 3 09:27:26 2003

Date: Fri, 03 Oct 2003 09:25:16 -0400
To: nanog@merit.edu
From: Andrew Fried <afried@cis.fed.gov>
Cc: iana@iana.org
Errors-To: owner-nanog-outgoing@merit.edu


--=====================_44245562==.ALT
Content-Type: text/plain; charset="us-ascii"; format=flowed

Anyone have any idea why a host from IANA would be scanning DNS servers?

;; AUTHORITY SECTION:
4.32.198.in-addr.arpa.  10551   IN      SOA     dot.ip4.int. 
hostmaster.ip4.int. 1928630 10800 900 604800 86400


10/03-01:29:45.947001 [**] [1:1616:4] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html>DNS named 
version attempt [**] [Classification: Attempted Information Leak] 
[Priority: 2] {UDP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=33581&protocol=UDP>33581 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.21.html>63.105.37.21:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=UDP>53
10/03-01:29:46.257443 [**] [1:255:8] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html>DNS zone 
transfer TCP [**] [Classification: Attempted Information Leak] [Priority: 
2] {TCP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=39050&protocol=TCP>39050 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.21.html>63.105.37.21:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=TCP>53
10/03-01:29:46.544719 [**] [1:1616:4] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html>DNS named 
version attempt [**] [Classification: Attempted Information Leak] 
[Priority: 2] {UDP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=33623&protocol=UDP>33623 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=UDP>53
10/03-01:29:47.067072 [**] [1:255:8] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html>DNS zone 
transfer TCP [**] [Classification: Attempted Information Leak] [Priority: 
2] {TCP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=39057&protocol=TCP>39057 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=TCP>53
10/03-01:57:47.356984 [**] [1:1616:4] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html>DNS named 
version attempt [**] [Classification: Attempted Information Leak] 
[Priority: 2] {UDP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=56229&protocol=UDP>56229 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=UDP>53
10/03-01:57:47.762762 [**] [1:255:8] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html>DNS zone 
transfer TCP [**] [Classification: Attempted Information Leak] [Priority: 
2] {TCP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=46196&protocol=TCP>46196 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=TCP>53
10/03-02:01:02.332948 [**] [1:1616:4] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html>DNS named 
version attempt [**] [Classification: Attempted Information Leak] 
[Priority: 2] {UDP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=36697&protocol=UDP>36697 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=UDP>53
10/03-02:01:02.739583 [**] [1:255:8] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html>DNS zone 
transfer TCP [**] [Classification: Attempted Information Leak] [Priority: 
2] {TCP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=47061&protocol=TCP>47061 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=TCP>53
10/03-02:01:59.042381 [**] [1:1616:4] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html>DNS named 
version attempt [**] [Classification: Attempted Information Leak] 
[Priority: 2] {UDP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=39008&protocol=UDP>39008 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=UDP>53
10/03-02:01:59.455718 [**] [1:255:8] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html>DNS zone 
transfer TCP [**] [Classification: Attempted Information Leak] [Priority: 
2] {TCP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=47296&protocol=TCP>47296 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=TCP>53
10/03-02:05:01.297316 [**] [1:1616:4] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html>DNS named 
version attempt [**] [Classification: Attempted Information Leak] 
[Priority: 2] {UDP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=46251&protocol=UDP>46251 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=UDP>53
10/03-02:05:01.710271 [**] [1:255:8] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html>DNS zone 
transfer TCP [**] [Classification: Attempted Information Leak] [Priority: 
2] {TCP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=48067&protocol=TCP>48067 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=TCP>53
10/03-02:05:28.770286 [**] [1:1616:4] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html>DNS named 
version attempt [**] [Classification: Attempted Information Leak] 
[Priority: 2] {UDP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=47507&protocol=UDP>47507 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=UDP>53
10/03-02:05:29.326121 [**] [1:255:8] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html>DNS zone 
transfer TCP [**] [Classification: Attempted Information Leak] [Priority: 
2] {TCP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=48191&protocol=TCP>48191 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=TCP>53
10/03-02:05:44.704398 [**] [1:1616:4] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html>DNS named 
version attempt [**] [Classification: Attempted Information Leak] 
[Priority: 2] {UDP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=48082&protocol=UDP>48082 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=UDP>53
10/03-02:05:45.755863 [**] [1:255:8] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html>DNS zone 
transfer TCP [**] [Classification: Attempted Information Leak] [Priority: 
2] {TCP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=48244&protocol=TCP>48244 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=TCP>53
10/03-02:10:20.499887 [**] [1:1616:4] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html>DNS named 
version attempt [**] [Classification: Attempted Information Leak] 
[Priority: 2] {UDP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=57711&protocol=UDP>57711 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=UDP>53
10/03-02:10:20.906450 [**] [1:255:8] 
<http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html>DNS zone 
transfer TCP [**] [Classification: Attempted Information Leak] [Priority: 
2] {TCP} 
<http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html>198.32.4.13:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=49232&protocol=TCP>49232 
-> 
<http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html>63.105.37.20:<http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&protocol=TCP>53

--=====================_44245562==.ALT
Content-Type: text/html; charset="us-ascii"

<html>
<body>
Anyone have any idea why a host from IANA would be scanning DNS
servers?<br><br>
;; AUTHORITY SECTION:<br>
4.32.198.in-addr.arpa.&nbsp; 10551&nbsp;&nbsp;
IN&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SOA&nbsp;&nbsp;&nbsp;&nbsp; dot.ip4.int.
hostmaster.ip4.int. 1928630 10800 900 604800 86400<br><br>
<br>
10/03-01:29:45.947001 [**] [1:1616:4]
<a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html">DNS
named version attempt</a> [**] [Classification: Attempted Information
Leak] [Priority: 2] {UDP}
<a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=33581&amp;protocol=UDP">33581</a>
-&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.21.html">63.105.37.21</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=UDP">53</a><br>
10/03-01:29:46.257443 [**] [1:255:8] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html">DNS zone transfer TCP</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=39050&amp;protocol=TCP">39050</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.21.html">63.105.37.21</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=TCP">53</a><br>
10/03-01:29:46.544719 [**] [1:1616:4] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html">DNS named version attempt</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {UDP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=33623&amp;protocol=UDP">33623</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=UDP">53</a><br>
10/03-01:29:47.067072 [**] [1:255:8] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html">DNS zone transfer TCP</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=39057&amp;protocol=TCP">39057</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=TCP">53</a><br>
10/03-01:57:47.356984 [**] [1:1616:4] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html">DNS named version attempt</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {UDP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=56229&amp;protocol=UDP">56229</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=UDP">53</a><br>
10/03-01:57:47.762762 [**] [1:255:8] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html">DNS zone transfer TCP</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=46196&amp;protocol=TCP">46196</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=TCP">53</a><br>
10/03-02:01:02.332948 [**] [1:1616:4] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html">DNS named version attempt</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {UDP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=36697&amp;protocol=UDP">36697</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=UDP">53</a><br>
10/03-02:01:02.739583 [**] [1:255:8] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html">DNS zone transfer TCP</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=47061&amp;protocol=TCP">47061</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=TCP">53</a><br>
10/03-02:01:59.042381 [**] [1:1616:4] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html">DNS named version attempt</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {UDP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=39008&amp;protocol=UDP">39008</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=UDP">53</a><br>
10/03-02:01:59.455718 [**] [1:255:8] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html">DNS zone transfer TCP</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=47296&amp;protocol=TCP">47296</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=TCP">53</a><br>
10/03-02:05:01.297316 [**] [1:1616:4] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html">DNS named version attempt</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {UDP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=46251&amp;protocol=UDP">46251</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=UDP">53</a><br>
10/03-02:05:01.710271 [**] [1:255:8] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html">DNS zone transfer TCP</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=48067&amp;protocol=TCP">48067</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=TCP">53</a><br>
10/03-02:05:28.770286 [**] [1:1616:4] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html">DNS named version attempt</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {UDP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=47507&amp;protocol=UDP">47507</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=UDP">53</a><br>
10/03-02:05:29.326121 [**] [1:255:8] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html">DNS zone transfer TCP</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=48191&amp;protocol=TCP">48191</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=TCP">53</a><br>
10/03-02:05:44.704398 [**] [1:1616:4] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html">DNS named version attempt</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {UDP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=48082&amp;protocol=UDP">48082</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=UDP">53</a><br>
10/03-02:05:45.755863 [**] [1:255:8] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html">DNS zone transfer TCP</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=48244&amp;protocol=TCP">48244</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=TCP">53</a><br>
10/03-02:10:20.499887 [**] [1:1616:4] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-1616.html">DNS named version attempt</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {UDP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=57711&amp;protocol=UDP">57711</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=UDP">53</a><br>
10/03-02:10:20.906450 [**] [1:255:8] <a href="http://10.192.0.110/198/32/4/../../../sig/sigsid-255.html">DNS zone transfer TCP</a> [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} <a href="http://10.192.0.110/198/32/4/../../../198/32/4/src198.32.4.13.html">198.32.4.13</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=49232&amp;protocol=TCP">49232</a> -&gt; <a href="http://10.192.0.110/198/32/4/../../../63/105/37/dest63.105.37.20.html">63.105.37.20</a>:<a href="http://www.portsdb.org/bin/portsdb.cgi?portnumber=53&amp;protocol=TCP">53</a><br>
</body>
</html>

--=====================_44245562==.ALT--

home	help	back	first	fref	pref	prev	next	nref	lref	last	post